One reason you may want to enable Windows SSO within Firefox, is so that your users on Azure AD or Hybrid joined machines can log into Microosft 365 services, such as Outlook, without having to re-authenticate. In this post, I will show you how to leverage Intune and custom configuration profiles to configure Firefox to enable Windows SSO.

Prerequisites

• Firefox ADMX file located here
• Intune
• Mozilla Firefox version 91 or newer
• Intune Administrator
• Test Machine with a valid Intune License

Create the Policy

1. Navigate to the Intune admin portal
   
2. Go to Devices > Windows > Configuration profiles > + Create profile
   
3. Under ‘Platform‘ select Windows 10 and later. For ‘Profile type‘ select Templates, and then select a Custom template.
   
4. Give you new configuration policy a good name and description so other administrators will understand what it does without having to view the configuration policy itself.
   
5. If you have not done so already, download the most recent Firefox ADMX files from here. Then, open the firefox.admx file in a notepad or VS Code and copy the contents for the next step.
   
6. Enter the following items
   

   Name	Ingest Firefox ADMX
   Description	Ingests Firefox ADMX Files v4.7
   OMA-URI	./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/Firefox/Policy/Firefox
   Data Type	String
   Value	[copy the contents of firefox.admx]

   

7. Next, create a new OMA-URI setting using the following information
   

   Name	Windows SSO
   Description	Firefox will use credentials stored in Windows to sign in to Microsoft, work, and school accounts.
   OMA-URI	./Device/Vendor/MSFT./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/WindowsSSO/Policy/ConfigOperations/ADMXInstall/Firefox/Policy/Firefox
   Data Type	String
   Value	<enabled />

   

8. Once finished, you should have two new settings. Click Next
   
9. In the Assignments tab, assign the new configuration policy to a group, all users or all devices. In my example, I applied it to all of my users.
   
10. Finally, in the Review + Create section, review your policy. If there are no further changes you are wanting to create then press the, ‘create‘ button to publish your new configuration policy.
    

Validate

1. In the Intune portal I can view the status of my configuration policy. Below I can see that it has successfully applied to my endpoint.
   
2. In the Firefox settings, under Privacy & Security I can now see that the SSO setting is not only enabled, its also managed.
   
3. I can test this out by going to login.microsoftonline.com and instead of prompting for credentials, it will automatically sign me in.